Trojan.DownLoader12.28912

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER3121.dir00\svchost.exe.mdmp 16325836412032396

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'63.##0.138.231':139
'63.##0.23.10':445
'63.##0.160.95':139
'63.##0.59.135':139
'63.##0.187.223':445
'63.##0.179.180':445
'63.##0.45.63':445
'63.##0.115.188':445
'63.##0.181.115':445
'63.##0.95.236':139
'63.##0.37.62':139
'63.##0.182.100':139
'63.##0.2.106':139
'63.##0.199.218':139
'63.##0.134.145':139
'63.##0.66.30':139
'63.##0.107.101':139
'63.##0.101.214':139
'63.##0.172.42':139
'63.##0.176.216':445
'63.##0.22.78':445
'63.##0.104.202':445
'63.##0.30.189':445
'63.##0.194.181':445
'63.##0.45.236':445
'63.##0.166.171':445
'63.##0.134.194':445
'63.##0.14.135':445
'63.##0.108.253':445
'63.##0.255.215':445
'63.##0.39.188':445
'63.##0.150.42':445
'63.##0.215.65':445
'63.##0.45.151':445
'63.##0.102.207':445
'63.##0.184.102':445
'63.##0.251.153':445
'63.##0.94.64':445
'63.##0.62.236':139
'63.##0.251.153':139
'63.##0.94.64':139
'63.##0.39.188':139
'63.##0.45.151':139
'63.##0.102.207':139
'63.##0.104.202':139
'63.##0.30.189':139
'63.##0.184.102':139
'63.##0.108.253':139
'63.##0.255.215':139
'63.##0.187.223':139
'63.##0.115.188':139
'63.##0.37.93':445
'63.##0.23.10':139
'63.##0.181.115':139
'63.##0.150.42':139
'63.##0.215.65':139
'63.##0.179.180':139
'63.##0.45.63':139
'63.##0.139.14':139
'63.##0.138.248':139
'63.##0.216.166':139
'63.##0.208.170':139
'63.##0.251.213':139
'63.##0.251.81':139
'63.##0.144.251':139
'63.##0.204.121':139
'63.##0.81.204':139
'63.##0.70.106':139
'63.##0.194.181':139
'63.##0.134.194':139
'63.##0.176.216':139
'63.##0.22.78':139
'63.##0.14.135':139
'63.##0.108.209':139
'63.##0.5.238':139
'63.##0.45.236':139
'63.##0.166.171':139
'63.##0.216.40':139
'63.##0.138.60':139
'63.##0.209.45':139
'63.##0.150.216':139
'63.#50.86.0':139
'63.##0.28.82':139
'63.#50.71.7':139
'63.##0.193.85':139
'63.##0.110.34':139
'63.##0.179.186':139
'63.##0.129.111':139
'63.##0.143.237':139
'63.##0.48.26':139
'63.##0.193.133':139
'63.##0.71.213':139
'63.##0.21.215':139
'63.##0.186.117':139
'63.##0.43.218':139
'63.##0.141.239':139
'63.##0.146.253':139
'63.##0.238.45':139
'63.##0.31.207':139
'63.##0.200.180':139
'63.##0.201.100':139
'63.##0.162.241':139
'63.##0.189.151':139
'63.##0.60.73':139
'63.##0.64.105':139
'63.##0.206.170':139
'63.##0.147.65':139
'63.##0.239.161':139
'63.##0.62.207':139
'63.##0.79.13':139
'63.##0.196.46':139
'63.##0.104.232':139
'63.##0.239.70':139
'63.##0.130.179':139
'63.##0.206.175':139
'63.##0.39.79':139
'63.##0.62.236':445
'63.##0.2.106':445
'63.##0.251.81':445
'63.##0.144.251':445
'63.##0.199.218':445
'63.##0.134.145':445
'63.##0.101.214':445
'63.##0.37.62':445
'63.##0.182.100':445
'63.##0.81.204':445
'63.##0.70.106':445
'63.##0.216.166':445
'63.##0.108.209':445
'63.##0.5.238':445
'63.##0.208.170':445
'63.##0.251.213':445
'63.##0.204.121':445
'63.##0.139.14':445
'63.##0.138.248':445
'63.##0.49.43':139
'63.##0.129.167':139
'63.##0.89.54':139
'63.##0.147.196':139
'63.##0.216.204':139
'63.##0.155.186':139
'63.##0.53.181':139
'63.##0.227.67':139
'63.##0.108.0':139
'63.##0.113.127':139
'63.##0.107.101':445
'63.##0.95.236':445
'63.##0.172.42':445
'63.##0.66.30':445
'63.##0.160.95':445
'63.##0.20.120':139
'63.##0.28.88':139
'63.##0.59.135':445
'63.##0.138.231':445
'63.##0.19.188':445
'63.##0.116.85':445
'63.##0.185.146':445
'63.##0.74.254':139
'63.##0.199.74':139
'63.##0.136.118':445
'63.##0.115.185':445
'63.##0.139.114':445
'63.##0.154.183':445
'63.##0.240.226':445
'63.##0.210.144':139
'63.##0.35.29':139
'63.##0.158.4':139
'63.##0.197.1':139
'63.##0.29.196':139
'63.##0.115.157':139
'63.##0.124.244':139
'63.##0.140.163':139
'63.##0.230.196':139
'63.##0.99.99':139
'63.##0.202.69':445
'63.##0.39.165':445
'63.##0.50.49':445
'63.##0.155.218':445
'63.##0.125.164':445
'63.##0.31.137':445
'63.##0.80.67':445
'63.##0.93.151':445
'63.##0.199.84':445
'63.##0.92.169':445
'63.##0.213.28':445
'63.##0.6.213':445
'63.##0.62.201':445
'63.##0.66.109':445
'63.#50.8.7':445
'63.##0.28.64':445
'63.##0.61.60':445
'63.#50.31.8':445
'63.##0.212.30':445
'63.##0.0.244':139
'63.#50.31.8':139
'63.##0.212.30':139
'63.##0.6.213':139
'63.#50.8.7':139
'63.##0.28.64':139
'63.##0.50.49':139
'63.##0.155.218':139
'63.##0.61.60':139
'63.##0.92.169':139
'63.##0.213.28':139
'63.##0.116.85':139
'63.##0.185.146':139
'63.##0.115.185':139
'63.##0.136.118':139
'63.##0.154.183':139
'63.##0.62.201':139
'63.##0.66.109':139
'63.##0.240.226':139
'63.##0.139.114':139
'63.##0.61.96':139
'63.##0.158.92':139
'63.##0.184.117':139
'63.##0.253.223':139
'63.##0.197.226':139
'63.##0.126.167':139
'63.##0.244.23':139
'63.##0.13.198':139
'63.##0.181.204':139
'63.##0.168.72':139
'63.##0.125.164':139
'63.##0.93.151':139
'63.##0.202.69':139
'63.##0.39.165':139
'63.##0.199.84':139
'63.##0.251.79':139
'63.##0.72.251':139
'63.##0.31.137':139
'63.##0.80.67':139
'63.##0.164.92':139
'63.##0.52.92':139
'63.##0.22.79':139
'63.##0.128.245':139
'63.##0.29.10':139
'63.##0.50.39':139
'63.##0.104.50':139
'63.##0.113.181':139
'63.##0.95.71':139
'63.##0.79.20':139
'63.##0.98.199':139
'63.##0.180.113':139
'63.##0.244.23':9988
'63.##0.13.198':9988
'63.##0.239.169':139
'63.##0.169.192':139
'63.##0.21.10':139
'63.##0.27.43':139
'63.##0.228.178':139
'63.##0.164.92':445
'63.##0.52.92':445
'63.##0.22.79':445
'63.##0.128.245':445
'63.##0.29.10':445
'63.##0.50.39':445
'63.##0.104.50':445
'63.##0.113.181':445
'63.##0.95.71':445
'63.##0.79.20':445
'63.##0.98.199':445
'63.##0.180.113':445
'63.##0.19.188':139
'63.##0.37.93':139
'63.##0.239.169':445
'63.##0.169.192':445
'63.##0.21.10':445
'63.##0.27.43':445
'63.##0.228.178':445
'63.##0.0.244':9988
'63.##0.0.244':445
'63.##0.197.1':445
'63.##0.126.167':445
'63.##0.244.23':445
'63.##0.29.196':445
'63.##0.115.157':445
'63.##0.230.196':445
'63.##0.35.29':445
'63.##0.158.4':445
'63.##0.181.204':445
'63.##0.168.72':445
'63.##0.184.117':445
'63.##0.251.79':445
'63.##0.72.251':445
'63.##0.253.223':445
'63.##0.197.226':445
'63.##0.13.198':445
'63.##0.61.96':445
'63.##0.158.92':445
'63.##0.39.165':9988
'63.##0.125.164':9988
'63.##0.61.60':9988
'63.##0.92.169':9988
'63.##0.251.79':9988
'63.##0.158.92':9988
'63.##0.181.204':9988
'63.##0.184.117':9988
'63.##0.253.223':9988
'63.##0.213.28':9988
'63.##0.140.163':445
'63.##0.210.144':445
'63.##0.99.99':445
'63.##0.124.244':445
'63.##0.74.254':445
'63.##0.240.226':9988
'63.##0.66.109':9988
'63.##0.199.74':445
'63.##0.185.146':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней